Analysis

  • max time kernel
    136s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:53

General

  • Target

    9c5d334a1edba5af5840c701f4574da8_JaffaCakes118.html

  • Size

    159KB

  • MD5

    9c5d334a1edba5af5840c701f4574da8

  • SHA1

    9cbe3a2c8ac5da84398b3df5b0919887582bfdbc

  • SHA256

    dfab5b98095f75e23e99265356435adc8fe9de908c9a4d3b793ec4acdb3fa133

  • SHA512

    5b4c98417c9fe1105be0e772908db9b9a6d2abedd427fdfd26fed8554d4cdcd94def8f6c0aa4e42e7e97f1155d35fe0a2dbd76b97984f5191e01bdded3d41878

  • SSDEEP

    1536:iGRT6KLK3whd2faDlyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:isxlyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c5d334a1edba5af5840c701f4574da8_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2204
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:537613 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1812

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b0c23821df71dc70b546c76894210978

      SHA1

      60009ce8eaf8b161dd683eb38f5c41bdc4c57af4

      SHA256

      ad144db970547fe90082fcd6f2d00412f38ba349472cbf66c2ae1c5f4b09033d

      SHA512

      1271bd19633e04474f24e88787a0070dfe917534340a2b39a711a3897902d3b752525a9a8bd9eb8fa455903d86b34325cf77a906a9b0bcacb764eaa1f4316a69

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8d9d7ad98ff36f0e4c1480605b259b84

      SHA1

      73d9be21a599b9ca3d7bd2b19f65790476709dfc

      SHA256

      a45c40cd0e9be0e093b112e6c3e9bbb789f51a98f89d1448fd412f8de128e85d

      SHA512

      247db27310d9696319368ecd10ab2908a070fe6cb52a1c53334ce736e327be41d1098ba2f922879f058c2dea2ee313a4c39337f062424eacba15cb8f9962ed48

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      eeee4003cf86d6baa527ce65ffd8be90

      SHA1

      6f239f8257fcf37fcc7befed42b94829637cb5c0

      SHA256

      0e039000c686bf5740b85a7cfd5dd39f19dccbaf112f492ce5e095357e718e55

      SHA512

      a15923e9fc451e9bb07b129a5f6e8061b3d30da160f7dd7f898f3f66ed7b510df1d4a81a423c32eae7adda651500c57b70c6046e5529b19dfc2967d253f66246

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      69287458bd51ce12b7c2cdbb1e6d6ddb

      SHA1

      b9ea9c52a86b425614c69ff00814003c692b9ad0

      SHA256

      89cdb0fd6d488e00bce0bd64fee724aaa873f7460df47877d13548a982f0997a

      SHA512

      85cc3b192bba85b068746c0e6d2d358ea74fb4afcd31ee3b740158e13b936d0a89917a7790d111b654b85e3455bc6e705ef5ac5fe6405b1795f40f0dc7ea5bab

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c17616b7913ed59c0db7d101321e7bd9

      SHA1

      e8542b62821578f4ac8c4faebf266fa6e7c9e006

      SHA256

      07244f14014a422c22b2c9d9492842453cfd7bf81e2c4157c856497a463eddf9

      SHA512

      a4c92112cfa126bc90734253e2aeb178f51ca1fde46216139c07ddbb9d0c49bcdf1b2a970051b40770eb0c4573d5935c157308c13d3aa9f75690fae2db0d3334

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a225db3b56f78ea4954e753eaa2bcaf5

      SHA1

      2521060c76b53fb9735ca7f9a298fca5f3474615

      SHA256

      3f38c10f292c6f4a7fd85c849f5756ec9c68ff81efb98ce458cf3e4aebe254e2

      SHA512

      91e19198524149f376a9b4cbf188284e284ee97edd59197dd1069cf4216c24da681c549411ae15ee7f6998b3eb42e97660245197668417b51815a562fb3e03b9

    • C:\Users\Admin\AppData\Local\Temp\Cab2C80.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar2D71.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/860-9-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/860-8-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/860-6-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2136-18-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2136-20-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2136-19-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2136-16-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB